Heretofore, various vehicle-mounted devices have been put into practical use which are, for example, an auto-light system wherein head lamps and small lamps are automatically turned ON and OFF in accordance with how bright or dark it is outside of a vehicle, and a raindrop sensing type intermittent windshield wiper system wherein wipers are automatically operated in accordance with the quantity of raindrops.
In general, these vehicle-mounted devices are supervised by a microcomputer and controlled to exhibit various operation modes based on software practically applied to the computer.
As is known, in the microcomputer, control programs stored in a ROM are executed successively to control the vehicle-mounted devices. However, if there is a problem in executing a program, a malfunction known as computer overrun sometimes occurs in which the computer runs, but fails to complete a processing of the program.
In order to deal with such overrun problem of the computer, monitoring circuits, such as watch dog timer (hereinafter referred to as "WDT") and the like, heretofore have been used in order to take necessary action upon occurrence of the overrun.
Usually, a vehicle-mounted battery is used for powering the vehicle-mounted devices. In order to save battery power during the time when a key switch is kept OFF, the microcomputer is put into a sleep mode/low power consumption mode when the key switch is turned OFF.
FIG. 4 shows a controller which has been considered for use for controlling an automotive auto-light system.
A controller 1 of the auto-light system comprises a microcomputer 2, a ROM 3 and a transistor 4. In the microcomputer 2, a lamp ON/OFF operating program stored in the ROM 3 is executed so that upon requirement of light-ON, the transistor 4 is turned ON to connect a battery 5 to a lamp 6. Battery 5 also supplies power to operate controller 1.
Now, a situation wherein operation of the microcomputer 2 is monitored by a watch dog timer (WDT) 7 will be considered. At predetermined intervals, the microcomputer 2 outputs to the WDT 7 the P-signal. (PRUN signal) representing that the program is being normally executed. The WDT 7 monitors the P-signal from the microcomputer 2 and, upon finding something wrong, outputs the R-signal (RESET signal) to reset the microcomputer 2.
When an overrun occurs, it is impossible to predict what occurs first or is earlier, stopping of the P-signal or changing of the output signal from the microcomputer to an L-level. If the P-signal stops before changing of the output signal from the microcomputer to the L-level, the WDT 7 will reset the microcomputer before changing of the output signal from the microcomputer to the L-level, keeping the lamp 6 ON. Since the P-signal is outputted once a "time interval", it may take as long as the "time period" to detect stopping of the P-signal and the output signal from the microcomputer can change to the L-level before the stopping of the P-signal is detected. After stopping of the P-signal is detected, the WDT 7 resets the microcomputer, returning it to normal operation. However, despite this occurring, there is no practical problem since the time from the start of the overrun to the resetting of the microcomputer takes only several milliseconds. This time period is so short that the device, such as lamp 6, cannot follow the brief change of the output signal from the microcomputer and a driver of the motor vehicle would not recognize any change in the operation of lamp 6.
When a key switch 8 of the motor vehicle is turned OFF, the microcomputer 2 is put in the sleep mode/low power consumption mode to reduce power consumption and thereby save the power of the battery 5. When this occurs, the P-signal from the microcomputer 2 stops. However, upon sensing stopping of the P-signal, the WDT 7 tends to output the R-signal to reset the microcomputer 2, misconstruing the stop as an abnormality of the computer.
In order to avoid such drawback, the microcomputer 2 outputs the S-signal (SLEEP signal) to the WDT 7 when put into the sleep mode/low power consumption mode. Upon receiving the S-signal, the WDT 7 stops outputting the R-signal, judging that the microcomputer has been put into the sleep mode/low power consumption mode. Thus, the S-signal is a reset prevent signal since the microcomputer 2 outputting the S-signal to the WDT 7, prevents the WDT 7 from resetting the microcomputer 2.
However, it is very difficult to foresee the time and condition when such an overrun of the microcomputer occurs. Assuming that the microcomputer 2 overruns with the lamp 6 kept ON and also outputs the S-signal even though not in the sleep mode/low power consumption mode, the WDT 7 does not output the R-signal because of receiving the S-signal irrespective of the fact it is capable of sensing the abnormality of the microcomputer 2 by sensing lack of the P-signal. As a result, the microcomputer 2 is not reset and thus, the lamp 6 is turned OFF. If the S-signal is not issued at the beginning of the overrun, the WDT 7 can sense the abnormality of the microcomputer 2 by sensing the lack of the P-signal, and thus it can avoid erroneously turning OFF of the lamp 6 by outputting the R-signal for resetting the microcomputer 2.
In the example of FIG. 4, the description is directed to an automotive controller for controlling an auto-light system. Similar drawbacks are possessed also by an automotive controller for controlling a raindrop sensing type intermittent windshield wiper system. That is, when an overrun occurs in the microcomputer of an automotive controller having a watch dog timer for monitoring occurrence of an abnormality of the microcomputer which has a sleep mode/low power consumption mode, making the microcomputer initially issue a Sleep signal, the WDT receiving this Sleep signal is forced to stop resetting of the microcomputer. In this case, resetting of the microcomputer is not carried out, and thus, due to the overrun, output from the microcomputer to a controlled device is varied, thereby stopping operation of the controlled device.
In order to avoid this drawback, a measure may be considered that, when the Sleep signal is outputted upon turning of the key switch ON, the microcomputer is forced to be reset judging that the microcomputer has overrun. However, this type operation may be repeatedly made when overrun of the microcomputer actually occurs, and thus, the above-mentioned measure lacks reliability and stability.